Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(172)

Side by Side Diff: patches/ugly/09_enforce_vorbis_oob_divzero.patch

Issue 4533003: patched ffmpeg nov 2 (Closed) Base URL: svn://chrome-svn/chrome/trunk/deps/third_party/ffmpeg/
Patch Set: '' Created 10 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 diff -rpu -N orig/libavcodec/vorbis_dec.c ffmpeg-mt/libavcodec/vorbis_dec.c 1 diff -wurp -N orig/libavcodec/vorbis_dec.c ffmpeg-mt/libavcodec/vorbis_dec.c
2 --- orig/libavcodec/vorbis_dec.c» 2010-10-11 16:55:09 -0700 2 --- orig/libavcodec/vorbis_dec.c» 2010-11-04 08:07:57 -0700
3 +++ ffmpeg-mt/libavcodec/vorbis_dec.c» 2010-10-11 16:55:12 -0700 3 +++ ffmpeg-mt/libavcodec/vorbis_dec.c» 2010-11-04 08:08:01 -0700
4 @@ -974,6 +974,7 @@ static av_cold int vorbis_decode_init(AV 4 @@ -974,6 +974,7 @@ static av_cold int vorbis_decode_init(AV
5 } 5 }
6 6
7 init_get_bits(gb, header_start[0], header_len[0]*8); 7 init_get_bits(gb, header_start[0], header_len[0]*8);
8 + gb->buffer_enforcing=1; 8 + gb->buffer_enforcing=1;
9 hdr_type = get_bits(gb, 8); 9 hdr_type = get_bits(gb, 8);
10 if (hdr_type != 1) { 10 if (hdr_type != 1) {
11 av_log(avccontext, AV_LOG_ERROR, "First header is not the id header.\n" ); 11 av_log(avccontext, AV_LOG_ERROR, "First header is not the id header.\n" );
12 @@ -986,6 +987,7 @@ static av_cold int vorbis_decode_init(AV 12 @@ -986,6 +987,7 @@ static av_cold int vorbis_decode_init(AV
13 } 13 }
14 14
15 init_get_bits(gb, header_start[2], header_len[2]*8); 15 init_get_bits(gb, header_start[2], header_len[2]*8);
16 + gb->buffer_enforcing=1; 16 + gb->buffer_enforcing=1;
17 hdr_type = get_bits(gb, 8); 17 hdr_type = get_bits(gb, 8);
18 if (hdr_type != 5) { 18 if (hdr_type != 5) {
19 av_log(avccontext, AV_LOG_ERROR, "Third header is not the setup header. \n"); 19 av_log(avccontext, AV_LOG_ERROR, "Third header is not the setup header. \n");
20 @@ -1207,7 +1209,7 @@ static uint_fast8_t vorbis_floor1_decode 20 @@ -1210,7 +1212,7 @@ static int vorbis_floor1_decode(vorbis_c
21 adx = vf->list[high_neigh_offs].x - vf->list[low_neigh_offs].x; 21 adx = vf->list[high_neigh_offs].x - vf->list[low_neigh_offs].x;
22 ady = FFABS(dy); 22 ady = FFABS(dy);
23 err = ady * (vf->list[i].x - vf->list[low_neigh_offs].x); 23 err = ady * (vf->list[i].x - vf->list[low_neigh_offs].x);
24 - off = (int16_t)err / (int16_t)adx; 24 - off = (int16_t)err / (int16_t)adx;
25 + off = (int16_t)err / (int16_t)(adx?adx:1); 25 + off = (int16_t)err / (int16_t)(adx?adx:1);
26 if (dy < 0) { 26 if (dy < 0) {
27 predicted = floor1_Y_final[low_neigh_offs] - off; 27 predicted = floor1_Y_final[low_neigh_offs] - off;
28 } else { 28 } else {
29 @@ -1293,7 +1295,7 @@ static av_always_inline int vorbis_resid 29 @@ -1296,7 +1298,7 @@ static av_always_inline int vorbis_resid
30 uint_fast16_t j_times_ptns_to_read; 30 uint_fast16_t j_times_ptns_to_read;
31 31
32 voffset = vr->begin; 32 voffset = vr->begin;
33 - for (partition_count = 0; partition_count < ptns_to_read;) { // SPEC error 33 - for (partition_count = 0; partition_count < ptns_to_read;) { // SPEC error
34 + for(partition_count=0;partition_count<ptns_to_read && !(gb->buffer_exha usted && gb->index > gb->size_in_bits);) { // SPEC error 34 + for(partition_count=0;partition_count<ptns_to_read && !(gb->buffer_exha usted && gb->index > gb->size_in_bits);) { // SPEC error
35 if (!pass) { 35 if (!pass) {
36 uint_fast32_t inverse_class = ff_inverse[vr->classifications]; 36 uint_fast32_t inverse_class = ff_inverse[vr->classifications];
37 for (j_times_ptns_to_read = 0, j = 0; j < ch_used; ++j) { 37 for (j_times_ptns_to_read = 0, j = 0; j < ch_used; ++j) {
38 @@ -1613,6 +1615,7 @@ static int vorbis_decode_frame(AVCodecCo 38 @@ -1623,6 +1625,7 @@ static int vorbis_decode_frame(AVCodecCo
39 AV_DEBUG("packet length %d \n", buf_size); 39 AV_DEBUG("packet length %d \n", buf_size);
40 40
41 init_get_bits(gb, buf, buf_size*8); 41 init_get_bits(gb, buf, buf_size*8);
42 + gb->buffer_enforcing=1; 42 + gb->buffer_enforcing=1;
43 43
44 len = vorbis_parse_audio_packet(vc); 44 len = vorbis_parse_audio_packet(vc);
45 45
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698